CVE-2024-11666
Last modified
CVE-2024-11666 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Affected devices beacon to eCharge cloud infrastructure asking if there are any command they should run. This communication is established over an insecure channel since peer verification is disabled everywhere. EPSS estimates a 0.42% chance of exploitation in the next 30 days.
Description
Affected devices beacon to eCharge cloud infrastructure asking if there are any command they should run. This communication is established over an insecure channel since peer verification is disabled everywhere. Therefore, remote unauthenticated users suitably positioned on the network between an EV charger controller and eCharge infrastructure can execute arbitrary commands with elevated privileges on affected devices. This issue affects cph2_echarge_firmware: through 2.0.4.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Echarge | Salia Plcc Firmware | <= 2.0.4 |
References
- https://www.onekey.com/resource/critical-vulnerabilities-in-ev-charging-stations-analysis-of-echarge-controllersExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-11666?
How severe is CVE-2024-11666?
How do I fix CVE-2024-11666?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-11660A vulnerability was found in code-projects Farmacia 1.0. It …5.4
- CVE-2024-11661A vulnerability was found in Codezips Free Exam Hall Seating…9.8
- CVE-2024-11662A vulnerability was found in welliamcao OpsManage 3.0.1/3.0.…6.3
- CVE-2024-11663A vulnerability classified as critical was found in Codezips…9.8
- CVE-2024-11664A vulnerability, which was classified as critical, has been …9.8
- CVE-2024-11665Improper Neutralization of Special Elements used in a Comman…8.8
- CVE-2024-11667A directory traversal vulnerability in the web management in…9.8
- CVE-2024-11668An issue has been discovered in GitLab CE/EE affecting all v…5.3
- CVE-2024-11669An issue was discovered in GitLab CE/EE affecting all versio…7.5
- CVE-2024-1167 When SEW-EURODRIVE MOVITOOLS MotionStudio processes XML inf…7.5
- CVE-2024-11670Incorrect authorization in the permission validation compone…5.4
- CVE-2024-11671Improper authentication in SQL data source MFA validation in…5.4
Are you affected by CVE-2024-11666?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST